scan.yml

name: Scan

on:
  workflow_call:
    inputs:
      name_and_version:
        description: 'Name and version of tool to scan, e.g. foo:0.1.0'
        type: string
        required: true
    secrets:
      DOCKERHUB_USER:
        description: 'Docker Hub username'
        required: true
      DOCKERHUB_TOKEN:
        description: 'Docker Hub token'
        required: true
  workflow_dispatch:
    inputs:
      name_and_version:
        description: 'Name and version of tool to scan, e.g. foo:0.1.0'
        type: string
        required: true

concurrency:
  group: ${{ github.workflow }}-${{ inputs.name_and_version }}
  cancel-in-progress: true

jobs:

  scout:
    name: Scout
    permissions:
      security-events: write
      pull-requests: write
      packages: read
    runs-on: ubuntu-24.04
    steps:

    - name: Checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

    - name: Login to GitHub Container Registry
      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
      with:
        registry: ghcr.io
        username: uniget-bot
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Fix versions with special characters
      id: fix
      run: |
        name_and_version="$(
            echo "${{ inputs.name_and_version }}" \
            | sed 's/+/-/g'
        )"
        echo "name_and_version=${name_and_version}" >"${GITHUB_OUTPUT}"

    - name: Analyze for critical and high CVEs
      id: docker-scout-cves
      uses: docker/scout-action@8910519cee8ac046f3ee99686b0dc6654d5ba1a7 # v1.20.3
      with:
        command: cves
        image: ghcr.io/${{ github.repository }}/${{ steps.fix.outputs.name_and_version }}
        dockerhub-user: ${{ secrets.DOCKERHUB_USER }}
        dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
        sarif-file: sarif.output.json
        summary: true